2

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

Specially, can an attacker escape from the container or manipulate the host?

Improve this question

1 Answer 1

Reset to default
2

Systemd-nspawn only manages isolated processes. It cannot isolate resources (which systemd can).

As a constructive difference, in the case of namespaces, you start with no isolation and you add whatever you require — mounts, PIDs, networks, users, etc. In the case of jails, you start with a reasonable secure baseline since the processes, IPCs, mounts and users are always isolated. That does not mean you can't get to the same level of security.

We can create a fully isolated environment, which will automatically monitor the /proc and /sys pseudo-file systems and create an isolated loop-back interface and separate name space for PIDs. From there we can run what we want.

To limit the isolation problem we can use systemctl:

systemctl set-property  CPUShares=80 CPUQuota=25% MemoryLimit=1024M

So to conclude, by default you don't have the same level of security but you can get to the same level. Nspawn will probably also evolve a lot more in the near future.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .